CVE-2026-42576 apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery
An attacker can cause a denial of service in apko by providing a non-RSA key in a JWKS endpoint, triggering a panic during key discovery.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-42576?
CVE-2026-42576 is a medium-severity vulnerability in chainguard-dev apko, published on 9 May 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key (e.g. EC), the unchecked assertion panics and crashes apko. This affects any workflow that initializes the APK database and fetches repository keys. This issue has been patched in version 1.2.7.
Weakness: CWE-704
Which versions are affected by CVE-2026-42576?
3 open source packages ship an affected version, including chainguard.dev/apko.
| Package | Affected | Fixed in |
|---|---|---|
chainguard.dev/apko Go | All versions | 1.2.7 |
chainguard.dev/apko Go | All versions | 1.2.7 |
chainguard.dev/apko Go | All versions | 1.2.7 |
How do I fix CVE-2026-42576?
Upgrade chainguard.dev/apko to 1.2.7 or later.
Is CVE-2026-42576 being exploited?
There is no known exploitation of CVE-2026-42576 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-VJ96840, GHSA-m7hm-vm4x-28jf, GO-2026-5497, MINI-4rgw-fqwc-8fwg, MINI-cr5j-436v-wqgr, MINI-qhgw-vhmr-6g56.